Deep learning for the analysis of network traffic measurements
The application of machine learning models to the analysis of network traffic measurements has largely increased in recent years. In the networking domain, shallow models are usually applied, where a set of expert handcrafted features are needed to fix the data before training. There are two main pr...
Đã lưu trong:
| Tác giả chính: | |
|---|---|
| Định dạng: | masterThesis |
| Ngôn ngữ: | Tiếng Anh |
| Được phát hành: |
2019
|
| Những chủ đề: | |
| Truy cập trực tuyến: | https://hdl.handle.net/20.500.12008/21770 |
| Các nhãn: |
Không có thẻ, Là người đầu tiên thẻ bản ghi này!
|
| _version_ | 1868890126622392320 |
|---|---|
| author | Marín Freire, Gonzalo Miguel |
| author_browse | Marín Freire, Gonzalo Miguel |
| author_facet | Marín Freire, Gonzalo Miguel |
| author_role | author |
| collection | COLIBRI |
| dc.contributor.none.fl_str_mv | Marín Freire Gonzalo Miguel, Universidad de la República (Uruguay). Facultad de Ingeniería |
| dc.creator.none.fl_str_mv | Marín Freire, Gonzalo Miguel |
| dc.date.none.fl_str_mv | 2019-09-11T21:15:57Z 2019-09-11T21:15:57Z 2019 |
| dc.format.none.fl_str_mv | 70 p. application/pdf |
| dc.identifier.none.fl_str_mv | Marín Freire, G. Deep learning for the analysis of network traffic measurements [en línea] Tesis de maestría. Montevideo : Udelar.FI.IIE., 2019. https://hdl.handle.net/20.500.12008/21770 |
| dc.language.none.fl_str_mv | en eng |
| dc.publisher.none.fl_str_mv | Udelar.FI.IIE |
| dc.rights.none.fl_str_mv | info:eu-repo/semantics/openAccess Licencia Creative Commons Atribución – No Comercial – Sin Derivadas (CC-BY-NC-ND) |
| dc.source.none.fl_str_mv | reponame:COLIBRI instname:Universidad de la República instacron:Universidad de la República |
| dc.subject.none.fl_str_mv | Modelos de aprendizaje automático Mediciones de tráfico de red Arquitecturas de aprendizaje profundo |
| dc.title.none.fl_str_mv | Deep learning for the analysis of network traffic measurements |
| dc.type.none.fl_str_mv | Tesis de maestría info:eu-repo/semantics/masterThesis info:eu-repo/semantics/acceptedVersion |
| description | The application of machine learning models to the analysis of network traffic measurements has largely increased in recent years. In the networking domain, shallow models are usually applied, where a set of expert handcrafted features are needed to fix the data before training. There are two main problems associated with this approach: firstly, it requires expert domain knowledge to select the input features, and secondly, different sets of custom-made input features are generally needed according to the specific target (e.g., network security, anomaly detection, traffic classification). On the other hand, the power of machine learning models using deep architectures (i.e., deep learning) for networking has not been yet highly explored. These models have had huge success in various domains, notably in computer vision, natural language processing, machine translation, and more recently in gaming. The main goal of this work is to explore the power of deep learning models to enhance the analysis of network tra c measurements. To this end, the specific problem of detection and classi cation of network attacks is studied. As a major advantage with respect to the state-of-the-art in the field, the evaluation of different raw-traffic input representations, including packet and ow-level ones, is considered. Different deep learning architectures are explored, including convolutional neural networks and long short-term memory recurrent neural networks as core layers. In addition, three different datasets are crafted from publicly available network traffic captures and used for calibrating the considered input representations, as well as training and validating the proposed models. Different deep learning models are compared to a random forest model - commonly accepted as a highly accurate model for network traffic analysis, using the same raw input representations. In the malware detection task, a detection accuracy of 77.6% and 98.5% was achieved for packet and ow input representations respectively. For the malware classification task, an overall accuracy of 76.5% was achieved. In all evaluation tasks, the proposed deep learning models outperform the random forest ones. These initial results suggest that deep learning can be used to enhance malware detection without requiring expert domain knowledge to handcraft input features, opening the door to a broad set of potential applications for deep learning in networking. |
| eu_rights_str_mv | openAccess |
| format | masterThesis |
| id | anni_8cab4c99f8e38c5b37b7fc5bc3eba98e |
| identifier_str_mv | Marín Freire, G. Deep learning for the analysis of network traffic measurements [en línea] Tesis de maestría. Montevideo : Udelar.FI.IIE., 2019. |
| instacron_str | Universidad de la República |
| institution | Universidad de la República |
| instname_str | Universidad de la República |
| language | eng |
| language_invalid_str_mv | en |
| network_acronym_str | anni |
| network_name_str | oai-lr-anni |
| oai_identifier_str | oai:colibri.udelar.edu.uy:20.500.12008/21770 |
| publishDate | 2019 |
| publishDateSort | 2019 |
| publisher.none.fl_str_mv | Udelar.FI.IIE |
| reponame_str | COLIBRI |
| repository.mail.fl_str_mv | |
| repository.name.fl_str_mv | |
| repository_id_str | |
| rights_invalid_str_mv | Licencia Creative Commons Atribución – No Comercial – Sin Derivadas (CC-BY-NC-ND) |
| spelling | Deep learning for the analysis of network traffic measurementsMarín Freire, Gonzalo MiguelModelos de aprendizaje automáticoMediciones de tráfico de redArquitecturas de aprendizaje profundoThe application of machine learning models to the analysis of network traffic measurements has largely increased in recent years. In the networking domain, shallow models are usually applied, where a set of expert handcrafted features are needed to fix the data before training. There are two main problems associated with this approach: firstly, it requires expert domain knowledge to select the input features, and secondly, different sets of custom-made input features are generally needed according to the specific target (e.g., network security, anomaly detection, traffic classification). On the other hand, the power of machine learning models using deep architectures (i.e., deep learning) for networking has not been yet highly explored. These models have had huge success in various domains, notably in computer vision, natural language processing, machine translation, and more recently in gaming. The main goal of this work is to explore the power of deep learning models to enhance the analysis of network tra c measurements. To this end, the specific problem of detection and classi cation of network attacks is studied. As a major advantage with respect to the state-of-the-art in the field, the evaluation of different raw-traffic input representations, including packet and ow-level ones, is considered. Different deep learning architectures are explored, including convolutional neural networks and long short-term memory recurrent neural networks as core layers. In addition, three different datasets are crafted from publicly available network traffic captures and used for calibrating the considered input representations, as well as training and validating the proposed models. Different deep learning models are compared to a random forest model - commonly accepted as a highly accurate model for network traffic analysis, using the same raw input representations. In the malware detection task, a detection accuracy of 77.6% and 98.5% was achieved for packet and ow input representations respectively. For the malware classification task, an overall accuracy of 76.5% was achieved. In all evaluation tasks, the proposed deep learning models outperform the random forest ones. These initial results suggest that deep learning can be used to enhance malware detection without requiring expert domain knowledge to handcraft input features, opening the door to a broad set of potential applications for deep learning in networking.Udelar.FI.IIEMarín Freire Gonzalo Miguel, Universidad de la República (Uruguay). Facultad de Ingeniería2019-09-11T21:15:57Z2019-09-11T21:15:57Z2019Tesis de maestríainfo:eu-repo/semantics/masterThesisinfo:eu-repo/semantics/acceptedVersion70 p.application/pdfMarín Freire, G. Deep learning for the analysis of network traffic measurements [en línea] Tesis de maestría. Montevideo : Udelar.FI.IIE., 2019.https://hdl.handle.net/20.500.12008/21770reponame:COLIBRIinstname:Universidad de la Repúblicainstacron:Universidad de la RepúblicaenengLas obras depositadas en el Repositorio se rigen por la Ordenanza de los Derechos de la Propiedad Intelectual de la Universidad de la República.(Res. Nº 91 de C.D.C. de 8/III/1994 – D.O. 7/IV/1994) y por la Ordenanza del Repositorio Abierto de la Universidad de la República (Res. Nº 16 de C.D.C. de 07/10/2014)info:eu-repo/semantics/openAccessLicencia Creative Commons Atribución – No Comercial – Sin Derivadas (CC-BY-NC-ND)oai:colibri.udelar.edu.uy:20.500.12008/217702026-04-14T10:27:45Z |
| spellingShingle | Deep learning for the analysis of network traffic measurements Marín Freire, Gonzalo Miguel Modelos de aprendizaje automático Mediciones de tráfico de red Arquitecturas de aprendizaje profundo |
| status_str | acceptedVersion |
| title | Deep learning for the analysis of network traffic measurements |
| title_full | Deep learning for the analysis of network traffic measurements |
| title_fullStr | Deep learning for the analysis of network traffic measurements |
| title_full_unstemmed | Deep learning for the analysis of network traffic measurements |
| title_short | Deep learning for the analysis of network traffic measurements |
| title_sort | Deep learning for the analysis of network traffic measurements |
| topic | Modelos de aprendizaje automático Mediciones de tráfico de red Arquitecturas de aprendizaje profundo |
| url | https://hdl.handle.net/20.500.12008/21770 |